CVE-2021-25926: Cross-site scripting in sickrage

April 20, 2021 (updated October 22, 2024)

In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the quicksearch feature. Therefore, an attacker can steal a user’s sessionID to masquerade as a victim user, to carry out any actions in the context of the user.

References

github.com/SiCKRAGE/SiCKRAGE
github.com/SiCKRAGE/SiCKRAGE/commit/9f42426727e16609ad3d1337f6637588b8ed28e4
github.com/advisories/GHSA-x823-j7c4-vpc5
github.com/pypa/advisory-database/tree/main/vulns/sickrage/PYSEC-2021-148.yaml
nvd.nist.gov/vuln/detail/CVE-2021-25926

Code Behaviors & Features

Detect and mitigate CVE-2021-25926 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →